Medium
CVE-2025-48258
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,686
Medium
CVE-2025-48242
Legal Pages <= 1.4.5 - Missing Authorization
Medium
CVE-2025-48251
Additional Custom Emails & Recipients for WooCommerce <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-48249
EAN for WooCommerce <= 5.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-48255
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP <= 6.2.4 - Cross-Site Request Forgery
Medium
CVE-2025-48272
WP Job Portal <= 2.3.2 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2025-48248
Sitewide Discount for WooCommerce: Apply Discount to All Products <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-48259
WP Mapa Politico España <= 3.8.0 - Cross-Site Request Forgery
Critical
CVE-2025-31069
HotStar – Multi-Purpose Business Theme <= 1.4 - Unauthenticated PHP Object Injection
Medium
CVE-2025-48257
Projectopia <= 5.1.17 - Missing Authorization
Medium
CVE-2025-3581
Newsletter <= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-2892
All in One SEO Pack <= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URL
Medium
CVE-2025-60247
Bux Woocommerce <= 1.2.3 - Missing Authorization
Medium
CVE-2025-3715
Bold Page Builder <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameter
High
CVE-2025-47273
setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write
Critical
ghsa-9fwj-9mjf-rhj3
laravel-auth0 SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions
Critical
ghsa-2f4r-34m4-3w8q
Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions
Critical
ghsa-9wg9-93h9-j8ch
Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions
Medium
CVE-2025-4669
Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode
Low
CVE-2025-22233
Spring Framework DataBinder Case Sensitive Match Exception
Medium
CVE-2025-4610
WP-Members <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_user_memberships Shortcode
Critical
CVE-2025-47275
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
High
CVE-2025-3812
WPBot Pro Wordpress Chatbot <= 13.6.2 - Authenticated (Subscriber+) Arbitrary File Deletion
Critical
CVE-2025-4389
Crawlomatic Multipage Scraper Post Generator <= 2.6.8.1 - Unauthenticated Arbitrary File Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.